Electronic voting - say goodbye to Democracy

[diamond geezer]

A good article on the dangers and dodgyness of electronic voting.

This is a long article, so here are some extracts.

link (http://www.wired.com/news/evote/0,2645,62790,00.html?tw=wn_story_top5)

*In January 2003, voting activist Bev Harris was holed up in the basement of her three-story house in Renton, Washington, searching the Internet for an electronic voting machine manual, when she made a startling discovery.

Clicking on a link for a file transfer protocol site belonging to voting machine maker Diebold Election Systems, Harris found about 40,000 unprotected computer files. They included source code for Diebold's AccuVote touch-screen voting machine, program files for its Global Election Management System tabulation software, a Texas voter-registration list with voters' names and addresses, and what appeared to be live vote data from 57 precincts in a 2002 California primary election. "There was a lot of stuff that shouldn't have been there," Harris said.

The California file was time-stamped 3:31 p.m. on Election Day, indicating that Diebold might have obtained the data during voting. But polling precincts aren't supposed to release votes until after polls close at 8 p.m. So Harris began to wonder if it were possible for the company to extract votes during an election and change them without anyone knowing. A look at the Diebold tabulation program provided a possible answer.

Harris discovered that she could enter the vote database using Microsoft Access -- a standard program often bundled with Microsoft Office -- and change votes without leaving a trace. Diebold hadn't password-protected the file or secured the audit log, so anyone with access to the tabulation program during an election -- Diebold employees, election staff or even hackers if the county server were connected to a phone line -- could change votes and alter the log to erase the evidence.

*In addition to glitches, there are concerns about the people behind the machines. A few voting company employees have been implicated in bribery or kickback schemes involving election officials. And there are concerns about the partisan loyalties of voting executives -- Diebold's chief executive, for example, is a top fund-raiser for President Bush.

As for criminal activity, a Sequoia regional manager was indicted in Louisiana in 2001 for conspiring to commit money laundering and bribery, although he was never convicted. Philip Foster was accused of facilitating a 10-year kickback scheme between his brother-in-law and an election official involving millions of dollars in overcharges for voting equipment. But while the election official went to jail, Foster, who still works for Sequoia, received immunity for his testimony and is in the process of trying to get the charges expunged from his record.
Sequoia spokesman Alfie Charles said the voting equipment in question wasn't Sequoia equipment, and that "Sequoia has never been under any investigation regarding the situation in Louisiana and absolutely no allegations of improper conduct have been directed at the company."

Tom Eschberger, a vice president for the largest voting firm, Election Systems & Software, or ES&S, was also involved in a bribery and kickback scheme, this one in Arkansas. Former Arkansas Secretary of State Bill McCuen was convicted for his role in the crime, but Eschberger, like Foster, received immunity. ES&S won't comment on the matter other than to say that Eschberger "wasn't prosecuted."

Up until 1995, Nebraska Sen. Chuck Hagel had been chairman of ES&S (then called American Information Systems) before quitting the company in March of that year two weeks before launching his Senate bid. ES&S, based in Omaha, Nebraska, manufactured the only voting machines used in the state in his election the following year. According to Neil Erickson, Nebraska's deputy secretary of state for elections, the machines counted 85 percent of votes in Hagel's race; the remaining votes were counted by hand.
Hagel, a first-time candidate who had lived out of the state for 20 years, came from behind to win two major upsets in that election: first in the primary race against a fellow Republican, then in the general race against Democrat Ben Nelson, the state's popular former governor. Nelson began the race with a 65 percent to 18 percent lead in the polls, but Hagel won with 56 percent of the vote, becoming the state's first Republican senator since 1972.
Now it was October 2002. Hagel was up for re-election, and Harris discovered that the senator still owned a financial stake in his former firm. Hagel held investments worth between $1 million and $5 million in the McCarthy Group. (Hagel won't reveal the exact size of his investment in the asset-management firm.) The McCarthy Group owns about 25 percent of ES&S, according to Hagel's chief of staff, Lou Ann Linehan. She estimated that Hagel's stake in ES&S amounts to about 1.5 percent.

Hagel disclosed the McCarthy investment in his campaign filings, but he neglected to mention that McCarthy owned part of the company counting his votes. His campaign treasurer, Michael R. McCarthy, was also chairman of the McCarthy Group and a member of ES&S's board of directors. "When I put the four magic words into a search engine -- voting machine and glitch -- there was this litany of miscounts," she said.
Harris documented 56 cases in which software flaws were implicated in miscounts and wrote an account of them (PDF) on her website. "I didn't finish (finding cases)," she said. "I just got tired of writing." In Dallas County, Texas, in 1998, for example, ES&S tabulation software failed to count about 44,000 votes that its optical-scan machine had recorded on ballots. In 2000 in Allamakee County, Iowa, 300 ballots fed into an ES&S optical-scan machine produced 4 million votes. The machine broke down repeatedly and flashed absurd numbers throughout the evening, election auditor Bill Roe Jr. told the Chicago Tribune.
"Equipment failures such as this are rare," wrote ES&S spokeswoman Meghan McCormick in an e-mail when asked about the problem. "When they do occur we carefully review each situation and make changes as needed."

Last year in Fairfax County, Virginia, which used machines made by Advanced Voting Solutions, voters in three precincts complained that when they touched the box next to school board member Rita Thompson's name to vote for her, an "X" appeared in the box, but then disappeared. They had to press the box up to five times before their selection took. Thompson lost the election by 1 percent of the vote.
Fairfax election officials had promised voters that the new machines would speed up the reporting of results, but another glitch prevented poll workers from transmitting votes to the county after polls closed, producing one of the slowest counts anyone could remember. Fairfax electoral board secretary Margaret Luca said it was noon the next day before results were in -- as opposed to 11 p.m. on election night when the county had finished in the past.
"We've just done an electronic Florida," state Sen. Ken Cuccinelli (R-Fairfax) told the Washington Post when it was over. Curiously, Luca gave the voting machines "an A-plus" anyway.
Harris said it concerned her that only large discrepancies seemed to get reported. "You're going to catch it when you know that 5,000 votes are cast and 140,000 are counted," she said. "But what if it's a difference of 500 or 100? Who checks?"

*The most famous example of election flipping occurred in the hotly contested 2000 presidential election in Florida when the tabulation system for Diebold's optical-scan system subtracted votes from Al Gore's total. While hanging chads distracted the nation, a few people noticed that in a Volusia County precinct where only 412 people voted, a Diebold system actually deleted votes for Gore, giving him minus 16,022 votes. Bush received 2,813 votes. Some news media had already called the win (PDF, see page 20) for Bush when someone noticed the numbers.
Diebold spokesman David Bear said the problem wasn't the machine but the result of someone uploading a second, faulty memory card to the county server after workers had already uploaded the real precinct results from another card.
"This error was immediately detected, through normal auditing procedures, and the votes were re-tabulated," Bear wrote in an e-mail.

[diamond geezer]

He contacted two grad students, 25-year-old Yoshi Kohno, a University of California at San Diego student who was in Maryland for the summer, and 22-year-old Adam Stubblefield, who was only two years away from completing his Ph.D. at Johns Hopkins.
Stubblefield made a name for himself in 2001 when he and a team of researchers that included Rubin cracked the encryption code used in Wi-Fi networks and exposed the networks' insecurity. The news made headlines and led the industry to revamp the wireless encryption protocol. He was also part of a group that broke the music industry's watermark code, which had been designed to thwart piracy.
Rubin told the students he had a "drop everything" project. By the time the three convened, Stubblefield had already downloaded the Diebold code and printed it out.
He and Kohno divvied up reams of paper and attacked the code with highlighters and pens. Within half an hour they discovered the first serious flaw.
It was a basic error that students in Cryptography 101 learn never to make: Diebold's programmers had written the key for unscrambling the system's encryption directly into the code. This meant the key would never change, and anyone reading the source code (including anyone who downloaded it from the FTP site) would know it. The same key unlocked the data on every machine. It was the equivalent of a bank assigning the same PIN to every customer's ATM card.
"Oh man, we thought, this is horrible," said Kohno. "We realized that the system was written by novices and we weren't really surprised then by anything else we found."
For two weeks they did little but pore over the code and write their analysis. They talked to no one about what they were doing, fearing that Diebold would try to stop them with a restraining order.
Initially, they thought they might find malicious code in the software that would allow the results of elections to be changed at will. Computer scientists had long contended that anyone with access to a voting system could slip the code in and no one would know.
"We found a system that was so vulnerable in itself that you didn't need to put malicious code into it to rig an election," Kohno said. The system, they concluded, was open to attack from both inside and out.

\Embarrassed by the Rubin report, Maryland commissioned its own audit of the Diebold system, hoping to dispel concerns about the machines. But that report confirmed that the machines were poorly programmed and "at high risk of compromise."
Six months later, Maryland officials hired a group of researchers from Raba Technologies -- some of whom were former employees of the National Security Agency -- to hack into the Diebold systems during a simulated election. Again, they confirmed what the Johns Hopkins researchers had found.
"We could have done anything we wanted to," said William Arbaugh, a University of Maryland assistant professor of computer science and one of the hackers. "We could change the ballots (before the election) or change the votes during the election."
Amazingly, Diebold interpreted the Raba report as positive. Diebold President Bob Urosevich said in a statement that the report confirmed "the accuracy and security of ... our voting systems as they exist today."
Maryland officials seemed to agree. Despite three reports detailing serious security problems, election officials continued to support the voting machines and the vendor.
Linda Lamone, Maryland's chief election official, told reporters her confidence in the system was unshaken because it had passed "the one certification process that matters most -- an election. The system performed flawlessly and earned the trust of Maryland's election officials and voters."
Karl Aro, director of Maryland's legislative services department, also told a TV station that Raba's damning report was "a validation" that the system was ready for the March primary.



How you count votes should be easy. The voter uses a black marker pen and places a cross next to his choice(s).
The vote is counted with a member from each party and a third person agreeing on each individual vote. It may take a little longer, but you can trust the outcome.

Of course, it wouldn't suit the television networks, so it's unlikely to happen, is it?

[zimv20]

bev harris has been working tirelessly on this issue for years. kudos to her.